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(54) Postage meter system and verification of postage charges 



(57) Methods of verifying use of postage charges in 
respect of mail items are disclosed. An authentication 
code is derived from a secret identification of a sender 
and a part of the destination address of the item. The 
code is printed on the mail item together with a sender 
account reference. On receipt of the mail item, the postal 
authority is able to use the account reference to access 
the secret identification and thereby determine if the 
destination address derived corresponds to that printed 
on the mail to verify the payment for the postage charge. 
In a modification, each time a postage meter effects a 
transaction with a remote centre, the remote centre gen- 
erates and transmits to the meter a transaction number. 
The meter utilises a unique key to generate an encrypt- 
ed code based on an item count and the transaction 
number. The code and a meter identification are printed 
on the mail. The postal authority reads the meter iden- 
tification to access the unique key to decrypt the code 
and then compares the current transaction number with 
the transaction number derived from the code in order 
to verify the postage charges used by the sender. 
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Description 

This invention relates to postage meters for printing 
franking impressions on mail items in respect of postage 
charges levied on those items and to verification of au- 5 
thenticity of the franking impressions printed on the mall 
items. 

As is well known, postage meters carry out account- 
ing procedures in respect of postage charges for mall 
items whereby the meter determines the revenue to the 
postal authority in respect of the postage charges ap- 
plied to mail Items by the user of the postage meter 
When used in an authorised manner the amount of the 
postage charge printed in the franking impression Is 
properly accounted for. Postage meters are constructed 
in a secure manner to preverit or at least inhibit use of 
the postage meter In an unauthorised manner. In the 
event that security is breached and the meter used in 
an unauthorised manner evidence of such breach is pro- 
vided. The secure construction of the postage meter in- 
hibits unauthorised access to the accounting means and 
to the print head of the postage meter whereby attempts 
might be made to operate the postage meter in a fraud- 
ulent manner in which for example higher amounts of 
postage charge are printed than are accounted for by 
the accounting means. It will be appreciated that, if 
franking impressions are printed on mail items and the 
cost of the postage charges represented by the franking 
impressions have not been properly accounted for, rev- 
enue value is stolen from the postal authority. 

A further possibility of fraud on the postal authority 
is that a franking impression genuinely printed by a post- 
age meter Is replicated on a plurality of mail items 
whereby only the cost of postage charge for a single 
item is accounted for in respect of a plurality of Items. 

According to one aspect of the invention a method 
of verifying postage charges used by a mall sender 
against postage purchased by the mall sender is char- 
acterised by the steps of storing a current transaction 
identity number at a remote centre; each time a trans- 
action Is effected between the remote centre and the 
postage meter generating a new transaction identity 
number and transmitting the new transaction identity 
number to the mall sender's postage meter; at the mail 
sender's postage meter generating a serial number for 
each mail item processed by the postage meter; using 
a unique key to generate an encrypted code from the 
serial number and the current transaction identity 
number; printing Information on each mail Item, the 
printed Information including a franking impression, said 
encrypted code and an identification number relating to 
the postage meter; and at a postal authority mail han- 
dling depot the steps of reading the printed information 
and using the identification number to determine the 
unique key and the current transaction identity number; 
using the unique key to decrypt the encrypted code to 
yield the current transaction identity number and com- 
paring the current transaction identity number stored In 



the remote centre with the transaction identity number 
obtained from the encrypted code printed in the printed 
information. 

According to a second aspect of the invention ap- 
paratus for verifying postage charges used by a mail 
sender against postage purchased by the mall sender 
is characterised by memory means storing a current 
transaction identity number at a remote centre; means 
operative each time a transaction is effected between 
the remote centre and a postage meter located at the 
mail sender to generate a new transaction identity 
number and to transmit the new transaction identity 
number to the postage meter; said postage meter in- 
cluding a mail item counter to generate a serial number 
for each mall item processed by the postage meter; cod- 
ing means operable to use a unique key to generate an 
encrypted code from the serial number and the current 
transaction identity number; and printing means for 
printing information on each mail item, the printed infor- 
mation including a franking impression, said encrypted 
code and an identification number relating to the post- 
age meter; and postal authority mail handling apparatus 
Including reading means to read the printed Information 
on each mail Item; means responsive to the identifica- 
tion number to determine the unique key and the current 
transaction identity number; decoding means to use the 
unique key to decrypt the encrypted code to yield the 
current transaction identity number and comparison 
means to compare the current transaction identity 
number stored in the remote centre with the transaction 
Identity number obtained from the encrypted code print- 
ed in the printed information. 

According to a third aspect of the invention a meth- 
od of verification of payment of postage charges In re- 
spect of a mail Item is characterised by the steps at a 
mall sender of providing destination information on the 
mail Item, deriving an authentication code from a mall 
sender's secret identification and at least an element of 
said destination infonmation and printing said authenti- 
cation code and a sender account reference on the mall 
item and the steps at a postal authority of using the 
sender account reference to determine the mail send- 
er's secret identification to derive said destination infor- 
mation from the authentication code and comparing the 
derived destination information with the destination on 
the mall item to provide verification of the franking. 

According to a fourth aspect of the Invention appa- 
ratus for verification of payment of postage charges in 
respect of a mail item is charcterised at a mall sender 
location by input means to input destination information 
in respect of the mail item; means providing a mail send- 
er's secret identification and a sender account refer- 
ence; code means to derive an authentication code from 
the mail sender's secret identification and at least an el- 
ement of said destination information; printing means 
operable to print said destination Information, said au- 
thentication code and the sender account reference on 
the mall Item and is characterised at a postal authority 
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by means operative in response to the sender account 
reference to deternnine the mail sender's secret Identifi- 
cation to derive said destination information from the au- 
thentication code and comparing the derived destination 
information with the destination on the mail item to pro- 
vide verification of the franking. 

An embodiment of the invention will be described 
hereinafter by way of example with reference to the 
drawings in which:- 

Figure 1 illustratesd a mail item, 
Figure 2 is a block diagram of mall preparation ap- 
paratus at a mail senders location, 
Figure 3 is a block diagram of mail receiving appa- 
ratus at a postal authority location, 
Figure 4 is a flow chart of steps carried out by the 
apparatus of Figures 2 and 3 in preparing mail items 
and in verification of postage charges in a first meth- 
od, and 

Figure 5 Is a flow chart of steps carried out by the 
apparatus of Figures 2 and 3 in an alternative meth- 
od. 

Reference will be made first to Figure 1 of the draw- 
ings. As is well known, mail items 1 0 such as envelopes 
carry destination information 11 and this information 
usually is located In a central area 1 2 of the envelope. 
The destination information may be printed on the outer 
surface of the envelope or, where window envelopes are 
used, the destination information is printed on an insert 
in the envelope. The destination information consists of 
a recipient 13 and postal address 14 to which it is re- 
quired that the mail Item be delivered by the postal au- 
thority, the postal address including a post code 15. The 
destination information 11 is in plain text of human read- 
able characters but it Is common for some mailers, es- 
pecially high volume mailers, to print the post code 15 
in bar code form. 

Referring now to Figure 2, mail preparation appa- 
ratus is similar to a postage meter and Includes elec- 
tronic accounting and control means comprising a mi- 
cro-processor 18 operating under program routines 
stored in a read only memory (ROM) 1 9. A keyboard 20 
is provided for input of commands to control operation 
of the apparatus by a user. The keyboard also enables 
input of data such as postage charge and destination 
address information. A display 21 is provided to enable 
display of Information to the user. A random access 
memory (RAM) 22 is provided for use as a working store 
for storage of temporary data during operation of the 
postage meter. Non-volatile memories 23, 24 are pro- 
vided for the storage of critical data relating to use of the 
postage meter and which is required to be retained even 
when the postage meter is not powered. The microproc- 
essor 1 8 carries out accounting functions in relation to 
use of the postage meter for franking mall items with 
postage charges applicable to handling of the mall items 
by the postal authority or another carrier. Accounting da- 



ta relating to use of the postage meter for printing frank- 
ing impressions representing postage charges for mall 
items and any other critical data to be retained is stored 
in the non-volatile memories 23, 24. The accounting da- 
5 ta includes a value of credit available for use by the me- 
ter In franking mall items 10, an accumulated total of val- 
ue used by the meter In franking mail items, a count of 
the number of mail items franked by the meter and a 
count of the number of mail items franked with a postage 
charge in excess of a predetermined value. The value 
of credit is stored in a descending credit register, the 
accumulated total value is stored in an ascending tote 
register, the count of items is stored in an items register 
and the count of Items franked with a postage charge In 
excess of a predetermined value is stored in a large 
items register. As Is well known in the postage meter art, 
each of the registers referred to hereinbefore for storing 
accounting data Is replicated in order to enable Integrity 
of the accounting data to be maintained even In the 
event of a fault or termination of power to the meter dur- 
ing a franking operation. Two replications of each of the 
registers are provided in each of the memory devices 
23, 24. 

A motor controller 25 is controlled by the microproc- 
essor 1 8 to control operation of motors 26 driving feed- 
ing means (not shown) for feeding a mail item past a 
digital print head 27. The digital print head 27 is prefer- 
ably a thermal print head Including selectively energis- 
able thermal printing elements. Sensors 28 are provided 
to sense and monitor feeding of the mail item. The sen- 
sors provide signals to the microprocessor to enable the 
microprocessor to control feeding of the mail Item and 
to selectively energise the thermal print elements of the 
print head 27 at appropriate times as the mall item Is fed 
past the print head. As the mail item is fed past the ther- 
mal printing elements of the print head 27 during a print- 
ing operation, the microprocessor outputs on line 28, in 
each of a series of printing cycles, print data signals se- 
lecting those ones of the printing elements which are to 
be energised In each respective printing cycle. A pulse 
of electrical power is supplied to the selected thermal 
printing elements from a power source 29 when a strobe 
signal is supplied by the microprocessor on a line 30 to 
the print head. 

Repeated selection and energisation of selected 
printing elements In the series of printing cycles results 
In printing of dots in required positions of a correspond- 
ing series of columns spaced along the mail item in the 
direction of feeding of the item. Accordingly a complete 
printed impression is built up in a column by column 
manner in the series of printing cycles of a printing op- 
eration. It Is to be understood that although the mail 
preparation apparatus is described hereinbefore as in- 
cluding a thermal printer for printing on mail items, other 
types of digital printing device such as, for example, im- 
pact dot matrix, Ink jet and laser may be provided. 

Postal authorities utilise automated equipment to 
handle a very high proportion of the mail Items received 
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in the postal systenn. Such equipment, as shown in Fig- 
ure 3, is provided with electronic means 31 for reading 
the destination information. The reading means 31 is re- 
quired to operate reliably at high feed speeds of the mail 
items and consequently is expensive. Accordingly, 5 
since the reading means is required to capture data only 
from the destination information 11, the reading means 
has a range of vision extending from adjacent a lower 
edge of the envelope to an extent sufficient to span the 
area 1 2 in which the destination information is located. 
As a result the reading means does not necessarily scan 
the upper area of the envelope in which any franking 
impression 16 is printed. 

Revenue protection can be improved if the activity 
of a sender of mail is checked against postage value 
purchased by the sender. Any substantial discrepancy 
between the monitored activity and the postage value 
purchased indicates the likelihood of fraud and can then 
be investigated. 

The address information 14 is required to be proc- 
essed on all mail items and hence it is proposed to em- 
bed information 1 7 identifying the sender of the mail item 
in the destination information 11 and to capture this iden- 
tification information at the same time that the destina- 
tion address 1 1 is read. The sender identification 1 7 may 
be merely the post code of the sender but this would be 
too easy for anyone to copy for fraudulent purposes. 
Therefore it is preferred that the sender identification 1 7 
be protected so as to provide security both for the send- 
er and for the postal authority 

The sender identification printed on the mail item 
includes two elements. The first element is a sender ac- 
count reference 32 by which the postal authority can 
identify the sender and the second element is an au- 
thentication code 33. Referring to Figure 3, after input 
of the destination information (step 34) the microproc- 
essor 18 genrates (step 35) the authentication code us- 
ing an algorithm which operates on a selected part of 
the destination information to be printed on the mail 
item, for example the destination post code 1 5. An iden- 
tity number, stored in the memories 23, 24 and known 
only to the sender and the postal authority is used in 
generation of the authentication code to ensure that the 
authentication code is unique to the sender. Software 
controlling operation of the apparatus includes routines 
stored in ROM 19 to generate the authentication code. 
The microprocessor 18, operating under the control of 
software routines operates the printer 27 to print (step 
36) a franking impression and the destination informa- 
tion, the latter including the sender identification. 

The authentication code may be printed in charac- 
ter form, i.e alpha-numeric, or in bar-code or other sym- 
bolic code form. If the authentication code is printed in 
bar-code form it may be combined with a destination 
post code printed in bar-code form as a two stack bar- 
code, or alternatively as an extended bar code. 

When a mail item is received at a postal authority 
sorting office, the mail reader 31 of an automated mail 



handling system 37 at the postal authority reads (step 
38) the authentication code and uses (step 39) the ac- 
count reference read from the mail item to determine, 
from a database 40, the identity number of the sender. 
The identity number is then used (step 41) to decode 
the authentication code to yield a destination post code 
for the Item. The destination post code yielded by step 
41 is checked (step 42) with the destination code 1 5 
read from the destination address printed on the item to 
provide a verification of authenticity of the item. If the 
check (step 42) indicates correspondence between the 
post codes (YES output of step 42), the mail handling 
process is continued and the senders activity record in 
the database 39 is updated (step 43). However if the 
check indicates a lack of verification (NO output of step 
42), the mail item is diverted (step 44) for manual in- 
spection. The activity record of the sender may be mere- 
ly a record of the number of mail items processed in a 
period of time or an audit trail containing number of 
items, dates and destinations of the items. 

Using the number of mail items received by the 
postal authority from a sender and an average postage 
charge value, the postal authority is enabled to estimate 
an approximate total postage charge value of items re- 
ceived from that sender and to correlate the estimated 
total postage charge value with the amount of postage 
purchased by that sender. Postage meters also account 
for the number of mail items printed with a franking im- 
pression and this information may be utilised to provide 
further correlation between mail items processed by the 
postage meter and mail items received by the postal au- 
thority. It will be appreciated that checking the activity of 
the sender as described hereinbefore and correlating 
this information against purchase of postage can im- 
prove the security of revenue to the postal authority with- 
out costly change, either in cost or performance, to the 
automated mail handling equipment of the postal au- 
thority. 

Duplication of an authentic franking impression is 
relatively easy using commonly available equipment. 
Franking impressions which are not authentic and are 
merely a copy of an authentic impression may be de- 
tected if an element of the destination information is in- 
cluded in the franking impression. However this does 
not fit well with the normal manner in which mail is han- 
dled by a sender. Usually, the mail item is prepared by 
printing the destination information at one location of the 
sender's premises and the franking impression is print- 
ed subsequently at a different location of the sender's 
premises. Another approach is for the postal authority 
to read all franking impressions and to capture the post- 
age charges thereof to generate a record of total post- 
age charge used. This record can then be used as a 
check against postage purchased by the sender. Fur- 
themnore this may not be able to detect all attempts at 
fraud as readily as is required. 

An improvement in detection of attempts at fraud 
may be obtained by shortening the time period over 
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which a comparison of the information is carried out. Ac- 
cordingly information is included in the franking impres- 
sion which is a function of a meter control transaction. 
A control transaction may be either resetting the meter 
with a new postage credit amount and reading meter s 
registers or just reading the meter registers. The regis- 
ters information may include the number of mail items 
processed by the meter. 

The mail preparation apparatus, shown in Figure 2, 
is provided with an I/O port 45 to enable communication io 
via a communication link 46, for example a telephone 
network, with a remote resetting centre 47 whereby 
transactions with the remote centre may be effected. 
Referring now to Figure 5, each time when a remote 
transaction is initiated (step 48), a transaction identity 
number is generated (step 49) by the remote centre 47 
and is stored in a store 50 at the remove centre. The 
transaction identity number is transmitted from the re- 
mote resetting centre 47 to the postage meter and this 
transaction identity number is stored in the non-volatile 20 
memories 23, 24. The postage meter generates (step 
51 ) a sequential Item number for each mail item and this 
is combined (step 52) with the transaction identity 
number to form an encrypted code. The encryption may 
be effected using a unique key and a non-linear algo- 2S 
rithm. The postage meter prints (step 53) information on 
the mail item, the printed information includes the frank- 
ing impression 16 including a postage charge value for 
the mail and the information also includes the meter li- 
cense number, sequential number of that item and the 50 
encrypted code. The printed information is read (step 
54) by the mail reader 31 and captured by the postal 
authority automated mail handling system 37 during 
normal processing of the mail items. The license 
number is used to determine (step 55) from the data- 3S 
base 40 the unique key and the current transaction iden- 
tity number. The unique key is used to decrypt (step 56) 
the code and thereby yield the transaction number em- 
bedded in the code. The transaction identity number ob- 
tained from the code is checked (step 57) against the 40 
transaction number from the database 40. If the check 
Is satisfactory (YET output of step 57) the sequential 
item number and the postage charge for the item are 
then entered (step 58) into the senders account record. 
Othenwise if the check is not satisfactory (NO output of 4S 
step 57), the mail item is diverted (step 59) for manual 
inspection. It is preferred that the meter license number, 
sequential number of the item and the encrypted code 
are included as a part of the franking impression but if 
desired these information items may be printed on a d if- so 
f erent part of the mail item and for example may be print- 
ed in an area 12 of the mail item in which a destination 
is printed. 

It will be appreciated that where information printed 
as a part of the franking impression is required for use ss 
in monitoring the activity of the sender, it is necessary 
that means be provided for automatically reading the ar- 
ea of the envelope in which the franking impression is 



printed. 

It will be appreciated that operations and steps car- 
ried out in the postage meter are performed by the mi- 
croprocessor 18 under the control of program routines 
stores in ROM. Furthermore, as is well known in the 
postage meter art, the postage meter must operate in a 
secure manner and be protected from attempts to use 
the meter fraudulently for example by utilising the post- 
age meter to print franking impressions on mail items 
for which no corresponding postage charge has been 
accounted for by the accounting means. Accordingly 
those parts of the postage meter required to be secured 
against unauthorised tampering are housed in a secure 
housing 60. 



Claims 

1. A method of verifying postage charges used by a 
mail sender against postage purchased by the mail 
sender characteriseed by the steps of storing a cur- 
rent transaction identity number at a remote centre; 
each time a transaction is effected between the re- 
mote centre and the postage meter generating a 
new transaction identity number and transmitting 
the new transaction identity number to the mail 
sender's postage meter; at the mail sender's post- 
age meter generating a serial number for each mail 
item processed by the postage meter; using a 
unique key to generate an encrypted code from the 
serial number and the current transaction identity 
number; printing information on each mail item, the 
printed information including a franking impression, 
said encrypted code and an identification number 
relating to the postage meter; and at a postal au- 
thority mail handling depot the steps of reading the 
printed information and using the identification 
number to determine the unique key and the current 
transaction identity number; using the unique key 
to decrypt the encrypted code to yield the current 
transaction identity number and comparing the cur- 
rent transaction identity number stored in the re- 
mote centre with the transaction identity number ob- 
tained from the encrypted code printed in the print- 
ed information. 

2. A method as claimed in claim 1 wherein the encrypt- 
ed code and the identification number are printed 
as a part of the franking impression. 

3. Apparatus for verifying postage charges used by a 
mail sender against postage purchased by the mail 
sender characterised by memory means (50) stor- 
ing a current transaction identity number at a re- 
mote centre; means (47) operative each time a 
transaction is effected between the remote centre 
(47) and a postage meter located at the mail sender 
to generate a new transaction identity number and 
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to transmit the new transaction identity number to 
the postage meter; said postage meter including a 
mail item counter to generate a serial number for 
each mail item processed by the postage meter; 
coding means operable to use a unique key to gen- 
erate an encrypted code from the serial number and 
the current transaction identity number; and printing 
means (27) for printing information on each mail 
item (10) , the printed information including a frank- 
ing impression (16), said encrypted code (33) and 
an identification number relating to the postage me- 
ter (32); and postal authority mail handling appara- 
tus including reading means (31 ) to read the printed 
information on each mail item (10); means (37) re- 
sponsive to the identification number to determine 
the unique key and the current transaction identity 
number; decoding means to use the unique key to 
decrypt the encrypted code to yield the current 
transaction identity number and comparison means 
to compare the current transaction identity number 
stored in the remote centre with the transaction 
identity number obtained from the encrypted code 
printed in the printed information. 

4. A method of verification of payment of postage 
charges in respect of a mail item characterised by 
the steps at a mail sender of providing destination 
information on the mail item, deriving an authenti- 
cation code from a mail sender's secret identifica- 
tion and at least an element of said destination in- 
formation and printing said authentication code and 
a sender account reference on the mail item and 
the steps at a postal authority of using the sender 
account reference to determine the mail sender's 
secret identification to derive said destination infor- 
mation from the authentication code and comparing 
the derived destination information with the desti- 
nation on the mail item to provide verification of the 
franking. 

5. A method as claimed in claim 4 wherein the authen- 
tication code and sender account reference are 
printed in an area of the mail item in which the des- 
tination information is printed. 

6. Apparatus for verification of payment of postage 
charges in respect of a mail item characterised at a 
mail sender location by input means (20) to input 
destination information (11) in respect of the mail 
item (10); means providing a mail sender's secret 
identification and a sender account reference (23, 
24); code means (18) to derive an authentication 
code from the mail sender's secret identification and 
at least an element of said destination information 
(11 ); printing means (27) operable to print said des- 
tination information (11), said authentication code 
(13) and the sender account reference (32) on the 
mail item (10) and characterised at a postal author- 



ity by means (37) operative in response to the send- 
er account reference to determine the mail sender's 
secret identification to derive said destination infor- 
mation from the authentication code and comparing 
5 the derived destination information with the desti- 
nation on the mail item to provide verification of the 
franking. 
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